CVE-2026-16498
The vulnerability CVE-2026-16498 affects terraform-mcp-server versions earlier than 1.1.0. It allows a malicious user to reuse another user’s Terraform token to run tool calls on that user’s behalf. The issue is fixed in version 1.1.0 and later.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of terraform-mcp-server before version 1.1.0, typically DevOps engineers and Terraform administrators who rely on the streamable-HTTP stateless transport mode.
Real-world impact
An attacker who gains access to a Terraform token can hijack the token to perform actions as other users, potentially executing unauthorized tool calls and accessing sensitive resources.
Why this severity
The CVSS score of 10 reflects that the flaw can be exploited over the network with no authentication, no user interaction, and a low attack complexity. The vulnerability changes the scope of the affected system, and it compromises confidentiality and integrity at a high level while only slightly affecting availability.
What to do about it
- 01Upgrade terraform-mcp-server to version 1.1.0 or later.
- 02Restart the terraform-mcp-server service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.